from Imaginary_Stand4909@lemmy.blahaj.zone to selfhosted@lemmy.world on 08 Aug 17:37
https://lemmy.blahaj.zone/post/46431155
Heya, I just wanted to post here before doing something that puts my stuff out on the internet for anyone to see š
So I have a basic, still in-configuration homelab network going on. Itās Modem --> OPNsense router --> Ubiquiti switch --> Openwrt AP. DNS and DHCP (via Dnsmasq) are working right now, each VLAN (Home Devices, IoT, and Guest) can access the internet. But Iām still tinkering and doing firewall stuff, so sometimes I reactivate the ISP router and switch back to that until I have everything perfect enough to not bother my family
I have a Proxmox homelab that Iāve been running services like Jellyfin and Immich in a Docker Debian VM for a few months now, but I was getting tired of typing out IPs and remembering port nums, especially after bouncing between my router and the original ISP router whenever Iām having network issues. So I wanted to finally map those IPs to human-friendly domains. So like, 192.168.10.247:8096 --> jellyfin.example.com, 192.168.10.247:2283 --> immich.example.com, etc.
I quickly learned that DNS services like Unbound and Dnsmasq do what they say on the tin, DNS only, so I canāt do a override to map ports to a domain, as they can only do IPs. My research led me to reverse proxies, and people said Caddy was simple on OPNsense, so I installed that and followed the official guide/documentation. But then I ran into the issue of needing the domain to be externally resolveable. Which then led me to realizing I need to use some sort of CA.
I know Letās Encrypt does it for free, plus the guide mentions them as a default so why not? Except I still need an actual external domain soā¦ Cloudflare? DuckDNS? Someone else? Iām so lostā¦
The biggest concern of mine right now is, if I set up a reverse proxy, does that mean my services are externally accessible? I was using Tailscale so I could avoid that, especially since I know services like Jellyfin have had serious vulnerabilities, and everyone says itās a good rule of thumb to just not expose services. But how do I map ip + port #s to a domain on OPNsense?
threaded - newest
You donāt need an external domain. Use .internal as your tld and you can use whatever domain your want. jellyfin.homelab.internal, for example.
I own a domain and run my internal stuff under internal records. Part of the reason for doing it this way is I can use the DNS challenge for issuing LE certs to the internal services automatically.
And no a reverse proxy will not expose anything to the Internet, unless you also open the port in your firewall (and forward it in NAT if itās on the lan and you use NAT).
If you donāt mind the warning āWoah, I donāt trust this websiteā, you donāt need to buy any domains. Just use local certificates.
Sample caddyfile that I use
#------------- general options { local_certs } #------------- services service.server.lan { reverse_proxy <INTERNAL SERVER IP>:<INTERNAL SERVER PORT> }However, you need to have a DNS entry which points
*.server.lanto the correct server. You can now visithttps://service.server.lan/which should point correctly.Best of luck!
No need to have an external domain. And you can set up an internal DNS to route any domain name to any IP address. Just be sure not to point anything to your external IP address from your ISP or any globally addressable IPv6 addresses.
Issue is that it might confuse your devices that jump between internal access and external access like your phone if you use a domain name thatās owned by someone else, like example.com. I have two domains, one for my VPSs and one for internal stuff. So when my devices are outside the network they canāt resolve any of the DNS addresses that are set up inside and canāt access any of the IP addresses. That is unless I connect with vpn. I also have pangolin for a few things that are accessible externally, but thatās rare since apps canāt use those kinds of authentication systems, just web front ends.